1. BUILDING A PRIVACY AND SECURITY PROGRAM FOR YOUR NON-PROFIT
Raf Portnoy SVP, Technology Steve Sheinberg General Counsel SVP, Privacy & Security
BUILDING A PRIVACY AND SECURITY PROGRAM FOR YOUR NON-PROFIT

2. THINKING ABOUT DATA GOVERNANCE
Create employee policies and build a culture that recognizes that employees are the main threat vector.
Teach employees, especially about social engineering.
Talk to the CIO.
Get your board onboard.
Get good agreements with vendors and key employees.
Plan well and strive for Cyber Resiliency.
Update software, install patches, remove non-approved software and hardware.
Follow the principle of least privilege.
Use two-factor authentication.
Ensure that your physical security is sufficient.
Encrypt all data, period.
Segregate differing data onto separate networks.
Monitor network traffic.
{Most of this is policy, not tech, driven}
Sheinberg and Portnoy

3. Asking: who is storing what information and where…
GOVERN
follow information governance best practices
DETERMINE
which data you need to protect
IDENTIFY
the data you have
Asking: who is storing what information and where…
Consider the risk of loss:
Political, Ethical, Social, Legal
How will you protect your data going forward?

4. Mission
Mission: The mission of the Information Security and Privacy Program is to provide exceptional, secure infrastructure support and innovation in the delivery of information technology security products and services to Your Organization staff and clients.
Improve cyber security awareness and data asset management.
Protect information and systems to ensure that the confidentiality, integrity, and availability of all information is consistent with mission needs, internal and external threats, information value, and industry compliance.

5. Information Security Needs
The number and complexity of information security threats are increasing. Advanced Persistent Threats (APTs) have penetrated environments that were previously thought to have been adequately secured and can remain unnoticed for extended periods of time.
Data system growth is compounding the need for increased security attention. Additionally, mobile security, cloud security, big data security, and social media security are now “today’s problems.”

6. Information Security Needs
How do we know this is enough?
We are employing cybersecurity best practices
We are following the recommendations made by our IT auditors.
We are following recommendations by our Security Compliance consultants.

7. Information Security Program
Confidentiality – Client, Employee and Organizational information Integrity – Consistent and accurate data Availability - Easily and safely accessible information
Integrity
Availability
Confidentiality
Identity & Access Management
Security Strategy &
Communication
Security Policy & Procedures
Security Culture & Awareness

8. Information Security Program
Confidentiality
Integrity
Availability
Identity & Access Management
Security Strategy & Communication
Security Policy & Procedures
Security Culture & Awareness
Traditional Cyber Security Triangle
Confidentially
Integrity
Availability
Cybersecurity Framework core:
Identify
Protect
Detect
Recover
Restore

9. Information Security Measures
Network Vulnerability Assessment
Annual independent analysis that identifies and quantifies security vulnerabilities on network systems
IT Systems Disaster Recovery
Well-defined, documented policies and procedures on how to establish access to IT services in case of the disaster
Network access and files monitoring
Real-time alerts and logs upon changes to confidential folders, or user accounts
Encryption
Secure messages and information
Mobile Device Management
Manage mobile devices ensuring
secure data on mobile devices
Private Printing
Secure printing to most network printers
Single Sign-On
Access multiple application with one credential
Secure Remote Access
Secure and seamless remote access
Desktop and Server Management
Patch and update desktops and servers
Software deployment and configuration management
Restricted Access to Client Management Systems (CMS)
Access restricted to within the organization’s network
Cybersecurity Awareness Program
Training and Communiques

10. Thank you! Questions?